icedid | 842d103f2a7083b553039dfc3c84d02d435a59ab2ca1cfb965180c76ed636b77

General

Target

1ba223ba6300c05c1e29105e519d884c2cebdbd1485838a46378c10dc77a8623.xll
Size

70KB
MD5

9ba7141f0a8d4840393af0230184dccd
SHA1

4c5a61203719c4fb3e64117a6c5e5980bd257802
SHA256

1ba223ba6300c05c1e29105e519d884c2cebdbd1485838a46378c10dc77a8623
SHA512

e2a857771574da00da240b84ad91b99d01cbe4fcf4dc0e7a592bce490752646a84e13010ed0523ce50891058cfdfd5cdc708660d4ad1b7184e43fd6056e1162d
SSDEEP

1536:MXUu709gnZgl7f/3jWCgiMthg8Mi3lHg9gIgmfgCjMiAOqTu/+vXWPbge96L94hH:Mw9eg5fPKCNAXMixmHBfFzmu/mAbgw1h

Score

10^/10

icedid 497724135 banker loader trojan

Malware Config

Extracted

Language

xlm4.0

Source

Extracted

Family

icedid

Campaign

497724135

C2

ovedfromasi.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1876	2656	rundll32.exe	81

Blocklisted process makes network request 1 IoCs

flow	pid	Process
19	1876	rundll32.exe

Loads dropped DLL 3 IoCs

pid	Process
2656	EXCEL.EXE
2656	EXCEL.EXE
1876	rundll32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2656	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1876	rundll32.exe
1876	rundll32.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2656	EXCEL.EXE
2656	EXCEL.EXE
2656	EXCEL.EXE
2656	EXCEL.EXE
2656	EXCEL.EXE
2656	EXCEL.EXE
2656	EXCEL.EXE
2656	EXCEL.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 1876	2656	EXCEL.EXE	85
PID 2656 wrote to memory of 1876	2656	EXCEL.EXE	85

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\1ba223ba6300c05c1e29105e519d884c2cebdbd1485838a46378c10dc77a8623.xll"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\SYSTEM32\rundll32.exe
  rundll32 C:\Users\Admin\JetBrainsdotNex.dll , DllGetClassObject
  2⤵
  - Process spawned unexpected child process
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1ba223ba6300c05c1e29105e519d884c2cebdbd1485838a46378c10dc77a8623.xll

Filesize
70KB

MD5
9ba7141f0a8d4840393af0230184dccd

SHA1
4c5a61203719c4fb3e64117a6c5e5980bd257802

SHA256
1ba223ba6300c05c1e29105e519d884c2cebdbd1485838a46378c10dc77a8623

SHA512
e2a857771574da00da240b84ad91b99d01cbe4fcf4dc0e7a592bce490752646a84e13010ed0523ce50891058cfdfd5cdc708660d4ad1b7184e43fd6056e1162d

Download Submit
C:\Users\Admin\JetBrainsdotNex.dll

Filesize
38KB

MD5
e0eb5ee1877137874ffa2da89ea711a4

SHA1
7be7d4eab05c0070ece0ca1e54b183829b227588

SHA256
33656b2710aa5d69afa7402f050b8f812923743f86a5bf4d1f22f8ce29be7179

SHA512
ca47e2a86edecffa9c6250d98750f7a49530dbea2bcff74678ab43d38410b2b3fdf8ea5b69bc656472ab3915fd225ff5ade64b3699d182075ed94155a56ec215

Download Submit
memory/1876-40-0x00007FF920630000-0x00007FF920825000-memory.dmp

Filesize
2.0MB

Download
memory/1876-31-0x00007FF920630000-0x00007FF920825000-memory.dmp

Filesize
2.0MB

Download
memory/1876-30-0x0000020A5D620000-0x0000020A5D683000-memory.dmp

Filesize
396KB

Download
memory/2656-8-0x00007FF920630000-0x00007FF920825000-memory.dmp

Filesize
2.0MB

Download
memory/2656-5-0x00007FF8E06B0000-0x00007FF8E06C0000-memory.dmp

Filesize
64KB

Download
memory/2656-9-0x00007FF8E06B0000-0x00007FF8E06C0000-memory.dmp

Filesize
64KB

Download
memory/2656-13-0x00007FF920630000-0x00007FF920825000-memory.dmp

Filesize
2.0MB

Download
memory/2656-14-0x00007FF8DE010000-0x00007FF8DE020000-memory.dmp

Filesize
64KB

Download
memory/2656-12-0x00007FF920630000-0x00007FF920825000-memory.dmp

Filesize
2.0MB

Download
memory/2656-15-0x00007FF8DE010000-0x00007FF8DE020000-memory.dmp

Filesize
64KB

Download
memory/2656-11-0x00007FF920630000-0x00007FF920825000-memory.dmp

Filesize
2.0MB

Download
memory/2656-10-0x00007FF920630000-0x00007FF920825000-memory.dmp

Filesize
2.0MB

Download
memory/2656-0-0x00007FF9206CD000-0x00007FF9206CE000-memory.dmp

Filesize
4KB

Download
memory/2656-4-0x00007FF920630000-0x00007FF920825000-memory.dmp

Filesize
2.0MB

Download
memory/2656-6-0x00007FF920630000-0x00007FF920825000-memory.dmp

Filesize
2.0MB

Download
memory/2656-7-0x00007FF920630000-0x00007FF920825000-memory.dmp

Filesize
2.0MB

Download
memory/2656-2-0x00007FF8E06B0000-0x00007FF8E06C0000-memory.dmp

Filesize
64KB

Download
memory/2656-3-0x00007FF8E06B0000-0x00007FF8E06C0000-memory.dmp

Filesize
64KB

Download
memory/2656-32-0x00007FF9206CD000-0x00007FF9206CE000-memory.dmp

Filesize
4KB

Download
memory/2656-33-0x00007FF920630000-0x00007FF920825000-memory.dmp

Filesize
2.0MB

Download
memory/2656-34-0x00007FF920630000-0x00007FF920825000-memory.dmp

Filesize
2.0MB

Download
memory/2656-1-0x00007FF8E06B0000-0x00007FF8E06C0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads